---
- name: "✅ Egress router | Assert a clearnet resolver is configured"
ansible.builtin.assert:
that: networks.internet.dns | length > 0
fail_msg: >-
networks.internet.dns must be set on a Tor node: dnsmasq runs with
no-resolv and would answer .onion only.
- name: "📦 Egress router | Install dnsmasq (host split-DNS forwarder)"
become: true
package_install: # nocheck: package-install only on the egress router this file is included for
id: dnsmasq
- name: "📁 Egress router | Ensure the dnsmasq drop-in directory exists"
ansible.builtin.file:
path: "{{ TOR_DNSMASQ_CONF | dirname }}"
state: directory
owner: root
group: root
mode: "0755"
- name: "🔧 Egress router | Ensure dnsmasq reads the drop-in directory"
ansible.builtin.lineinfile:
path: /etc/dnsmasq.conf
regexp: "^conf-dir="
line: "conf-dir={{ TOR_DNSMASQ_CONF | dirname }}/,*.conf"
create: true
owner: root
group: root
mode: "0644"
register: _tor_dnsmasq_confdir
- name: "🔎 Egress router | Detect foreign dnsmasq drop-ins (shared instance)"
ansible.builtin.find:
paths: "{{ TOR_DNSMASQ_CONF | dirname }}"
patterns: "*.conf"
excludes: "{{ TOR_DNSMASQ_CONF | basename }}"
register: _tor_dnsmasq_foreign
- name: "🔧 Egress router | Decide whether this dnsmasq is ours to reshape"
ansible.builtin.set_fact:
TOR_DNSMASQ_OWNS_LISTENER: "{{ _tor_dnsmasq_foreign.matched == 0 }}"
- name: "📝 Egress router | Render dnsmasq .onion split-DNS drop-in"
ansible.builtin.template: # nocheck: stack-host-template (per-host dnsmasq system config in /etc/dnsmasq.d)
src: dnsmasq-tor-onion.conf.j2
dest: "{{ TOR_DNSMASQ_CONF }}"
owner: root
group: root
mode: "0644"
vars:
TOR_DNS_UPSTREAMS: "{{ [ networks.internet.dns ] }}"
register: _tor_dnsmasq_conf
- name: "🔁 Egress router | Retry dnsmasq until docker0 exists after a boot"
when: TOR_DNSMASQ_OWNS_LISTENER | bool
block:
- name: "📁 Egress router | Ensure the dnsmasq unit drop-in directory exists"
ansible.builtin.file:
path: "{{ TOR_DNSMASQ_DROPIN | dirname }}"
state: directory
owner: root
group: root
mode: "0755"
- name: "📝 Egress router | Restart dnsmasq on failure"
ansible.builtin.copy:
src: dnsmasq-restart.conf
dest: "{{ TOR_DNSMASQ_DROPIN }}"
owner: root
group: root
mode: "0644"
register: _tor_dnsmasq_dropin
- name: "🚀 Egress router | Enable + (re)start dnsmasq"
ansible.builtin.systemd:
name: dnsmasq
enabled: true
daemon_reload: "{{ TOR_DNSMASQ_OWNS_LISTENER | bool and _tor_dnsmasq_dropin is changed }}"
state: "{{ 'restarted' if (_tor_dnsmasq_conf is changed or _tor_dnsmasq_confdir is changed) else 'started' }}"
- name: "🔀 Egress router | Route host name resolution through dnsmasq"
when: TOR_DNSMASQ_OWNS_LISTENER | bool
block:
- name: "🔀 Egress router | Point the host resolver at dnsmasq (127.0.0.1)"
ansible.builtin.template: # nocheck: stack-host-template (per-host resolver config in /etc/resolv.conf)
src: resolv.conf.j2
dest: /etc/resolv.conf
owner: root
group: root
mode: "0644"
unsafe_writes: true
- name: "🔀 Egress router | Let a name systemd-resolved refuses reach dnsmasq"
become: true
ansible.builtin.lineinfile:
path: /etc/nsswitch.conf
regexp: "^(hosts:.*\\bresolve)\\s*\\[!UNAVAIL=return\\](.*)$"
line: "\\1 [SUCCESS=return NOTFOUND=continue TRYAGAIN=return]\\2"
backrefs: true
- name: "🔀 Egress router | Route .onion traffic and bound the ports that carry no policy"
ansible.builtin.include_role:
name: svc-net-firewall
- name: "🛡️ Egress guard | Read back the chain that bounds the ports"
become: true
ansible.builtin.command:
argv: [nft, list, chain, inet, "{{ firewall_loaded_table }}", guard]
register: tor_egress_guard_chain
changed_when: false
- name: "🛡️ Egress guard | Refuse a guard that drops nothing"
ansible.builtin.assert:
that:
- "'drop' in tor_egress_guard_chain.stdout"
fail_msg: >-
The guard chain in {{ firewall_loaded_table }} carries no drop, so
TransPort and DNSPort are reachable from every source. These two ports
have no access policy of their own; this chain is the only boundary.
